CVE-2026-52978: Linux Kernel PSP Missing CAP_NET_ADMIN Permission Check

Technical summary

The vulnerability exists in the Linux kernel's PSP (Protocol Security Processor) netlink implementation. The dev-set and key-rotate netlink operations lack CAP_NET_ADMIN capability checks, relying solely on psp_dev_check_access() which only validates network namespace membership. This permits unprivileged users within the same netns to invoke operations that modify PSP version configuration and cryptographic key material—state that should be protected by administrative privilege. The fix requires adding proper capability enforcement to these operations before processing the netlink requests.

Business impact

Organizations using Linux systems with PSP networking features in multi-tenant or shared-namespace environments face elevated risk of configuration tampering and cryptographic key compromise. An unprivileged local attacker could alter PSP settings or rotate keys maliciously, potentially degrading the security of encrypted traffic or enabling denial of service. The impact is confined to local attack scenarios but could compromise the integrity of network security controls that depend on PSP's proper configuration.

Affected systems

The Linux kernel is affected. While the specific affected versions are not enumerated in the source data, the vulnerability resolution indicates this impacts kernel builds that include PSP networking support. Organizations should verify their kernel version against the vendor advisory and check whether PSP is enabled and actively used in their deployment. Systems without PSP functionality enabled are not at risk.

Exploitability

Exploitability is moderate but practical. An attacker must have local user-level access to the affected system and reside within the same network namespace as the target PSP device. No authentication bypass, race conditions, or kernel bugs are required—the flaw is straightforward permission enforcement. No public exploit code is known at this time, and the CVSS score of 5.5 reflects local-only attack vector and lack of confidentiality impact, though availability and integrity are directly threatened.

Remediation

Apply kernel updates from your Linux distribution that patch PSP to enforce CAP_NET_ADMIN capability checks on dev-set and key-rotate netlink operations. Verify the patch against the vendor advisory to confirm the specific kernel version that resolves this issue. Until patched, restrict network namespace access to trusted users only, and monitor netlink activity for suspicious PSP-related calls.

Patch guidance

Contact your Linux distribution vendor for patched kernel versions. The fix requires adding CAP_NET_ADMIN checks to the PSP netlink command handlers before processing dev-set and key-rotate operations. Rebuild and test the patched kernel in a staging environment before production deployment. Verify that PSP functionality remains operational post-patch and that administrative operations still work as expected.

Detection guidance

Monitor netlink traffic for PSP operations (dev-set, key-rotate) originating from unprivileged user contexts. Use audit framework rules to log CAP_NET_ADMIN capability checks and denials. Check kernel logs for permission-related errors in PSP subsystem operations. On vulnerable systems, correlate local user activity with netlink operations targeting PSP configuration to identify reconnaissance or tampering attempts.

Why prioritize this

While the CVSS score of 5.5 is medium, this vulnerability should be prioritized for rapid patching in environments where PSP is actively deployed for network encryption or security policy enforcement. The combination of local access, direct manipulation of cryptographic key material, and lack of current awareness (not in CISA KEV) means this may be overlooked—but the integrity threat to security-critical infrastructure justifies prompt remediation. Organizations not using PSP can defer this update.

Risk score, explained

CVSS 5.5 (Medium) reflects: local-only attack vector (AV:L), low attack complexity (AC:L), low privilege requirements (PR:L), no user interaction (UI:N), unchanged scope (S:U), no confidentiality impact (C:N), no integrity impact directly on user data (I:N), but high availability impact (A:H) due to key rotation and configuration tampering. The score appropriately captures the threat to system availability and operational integrity of PSP, though the ability to modify cryptographic keys elevates real-world risk beyond the numerical score alone.

Frequently asked questions